Conficker Stirs, updates and installs payload

Conficker, the bug that failed to impress anyone on April 1st has been seen to stir.

According to TrendMicro Conficker updated itself through P2P and dropped a payload similar to a keylogger on all of the systems infected. At the same time it appeared that the software was checking internet connectivity by hitting sites like MSN, MySpace and a couple of others.

To make matters more interesting it seems that Conficker may shut down on May 3rd. This is not confirmed and even if it is true the Worm could be reactivated at any time.

One more item of concern is that Conficker appears to talk to the Storm and Waldec Malware family.

Read more at CNet.

Researchers were analyzing the code of the software that is being dropped onto infected computers but suspect that it is a keystroke logger or some other program designed to steal sensitive data off the machine, said David Perry, global director of security education at Trend Micro.

The software appeared to be a .sys component hiding behind a rootkit, which is software that is designed to hide the fact that a computer has been compromised, according to Trend Micro. The software is heavily encrypted, which makes code analysis difficult, the researchers said.

The worm also tries to connect to MySpace.com, MSN.com, eBay.com, CNN.com and AOL.com as a way to test that the computer has Internet connectivity, deletes all traces of itself in the host machine, and is set to shut down on May 3, according to the TrendLabs Malware Blog.